Did someone made tcpdump working on 10.20 ?

[mtsat]

Hello,

I downloaded and compiled tcpdump3.4 a couple of week ago. I tried to use
it, but I can only see incoming data, never outgoing.
Someone (raj) explained me that a patch was missing, and that this patch
must me "patched" (poked) in order to see outbound data in promiscuous mode.
Many things to do .... So the question is : did someone has already this
"ready to use" PHNE_**** patch ?

Thanks

Michel

[Lutz Jaenicke]

Two things:
1. You do need a late "LAN products cumulative patch" (e.g. PHNE_18173 for
s700/10.20).
2. You must use
echo 'lanc_outbound_promisc_flag/W1' | /usr/bin/adb -w /stand/vmunix /dev/kmem
You can insert this e.g. into /sbin/init.d/lan

Best regards,
Lutz

>
>Thanks
>
>Michel
>
>

--
Lutz Jaenicke Lutz.J...@iee.TU-Berlin.DE
TU Berlin http://www.iee.TU-Berlin.DE/personen/jaenicke/
Institut fuer Elektrische Energietechnik Tel. +49 30 314-24552
Einsteinufer 11, D-10587 Berlin Fax. +49 30 314-21133

[Rick Jones]

: >I downloaded and compiled tcpdump3.4 a couple of week ago. I tried

: >to use it, but I can only see incoming data, never outgoing.

: Two things:

: 1. You do need a late "LAN products cumulative patch" (e.g.
: PHNE_18173 for s700/10.20).
: 2. You must use echo 'lanc_outbound_promisc_flag/W1' | /usr/bin/adb
: -w /stand/vmunix /dev/kmem You can insert this e.g. into
: /sbin/init.d/lan

I suspect that "straight-up" tcpdump will be fine for most folks, but
if anyone is feeling experimental I have a port of some BPF
functionality to a pushable streams module which can be used in
conjunction with promiscuous mode. This module does _not_ implement
/dev/bpf, but it does allow for in-kernel BPF filtering, packet
trimming to snaplen, and aggregation of selected packets into larger
buffers.

It is definitely experimental, I've only really used it on 11.X, but
it should in theory work on 10.20 as well. The sources are under
ftp://ftp.cup.hp.com/dist/networking/tools/ I think - could be misc
instead of tools. I also cannot recall as I'm typing if I have the
modified libpcap sources there - basically, it is all the setup from
pcap-dlpi, with read/access from pcap-bpf.

rick jones
--
these opinions are mine, all mine; HP might not want them anyway... :)
feel free to email, or post, but please do not do both...
my email address is raj in the cup.hp.com domain...